DeepSeek-PA v0.6.1 — Local IPC security hardening

DeepSeek-PA v0.6.1 — Local IPC security hardening / 本地 IPC 安全加固

English | 简体中文

English

DeepSeek-PA 0.6.1 is a security-focused developer preview that supersedes 0.6.0. It contains every discovery, project-startup, resilience and workspace improvement shipped in 0.6.0; see the 0.6.0 release notes for that feature set.

Security hardening

• SHA-256 action identifiers: project action IDs now use the first 24 hexadecimal characters of a deterministic SHA-256 digest instead of a 16-character SHA-1 prefix. These identifiers correlate local events; they are not authentication tokens.
• Pinned local iframe messaging: DPA-owned frames no longer use a wildcard postMessage target. The shell targets the local file:// context and accepts messages only from the expected frame window at the exact Cluster or Extension Center file URL. Child pages likewise require the expected parent window and exact shell URL, while accounting for Chromium's opaque file: event origin.
• Malicious-frame regression: the desktop bridge smoke test navigates the Cluster iframe to synthetic untrusted content and verifies that the frame cannot invoke the privileged Cluster API or receive appearance/project messages.

Included from 0.6.0

• Paginated GitHub repository discovery with visible queries, sorting, page jumps and explicit 1,000-result API boundaries.
• DSH credential/ACP startup compatibility, persistent startup errors, retry and duplicate-start protection.
• Runtime cancellation and cleanup safeguards, refreshed Cluster/Extension UI, shared appearance controls and startup WebView readiness handling.

Validation and publication status

The local 0.6.1 gate completed syntax checks and 100/100 regression tests, including the new action-ID and local-frame IPC tests. The malicious-frame desktop bridge regression also passed locally. See the 0.6.1 validation summary.

The exact release commit f9407191f9a8493a8b767370183811c460aa743b passed the Windows and Ubuntu DPA checks and the CodeQL Actions plus JavaScript/TypeScript analysis. GitHub reports zero open CodeQL alerts; the two findings first detected on 0.6.0 are marked fixed by this commit.

Download only version-matched 0.6.1 setup/portable assets from Releases and verify SHA256SUMS.txt. DSH is not bundled; prepare the separately configured runtime described in the Windows installation guide.

简体中文

DeepSeek-PA 0.6.1 是以安全加固为重点的开发者预览版，取代 0.6.0。它完整包含 0.6.0 已发布的扩展发现、项目启动、运行韧性和工作区改进；功能详情见 0.6.0 更新说明。

安全加固

• SHA-256 操作标识： 项目操作 ID 由 16 位十六进制 SHA-1 前缀升级为确定性 SHA-256 摘要的前 24 位十六进制字符。该 ID 用于关联本地事件，不是认证令牌。
• 限定本地 iframe 消息边界： DPA 自有 frame 不再使用通配 postMessage 目标。外壳只向本地 file:// 上下文发送消息，并且仅接受来自预期 frame 窗口及精确集群/扩展中心文件 URL 的消息；子页面也会校验预期父窗口和精确外壳 URL，同时兼容 Chromium 对本地 file: 消息报告的不透明来源。
• 恶意 frame 回归： 桌面桥接冒烟测试会把集群 iframe 导航到合成的不可信内容，验证它既不能调用特权集群 API，也收不到外观或项目消息。

包含 0.6.0 的全部功能

• GitHub 仓库分页发现、可见查询、排序、跳页和明确的 1,000 项 API 边界。
• DSH 凭据/ACP 启动适配、持续错误提示、重试与重复启动保护。
• 运行取消及清理保护、集群/扩展界面更新、共享外观设置和 WebView 启动就绪处理。

验收与发布状态

0.6.1 本地门禁已通过语法检查及 100/100 项回归测试，包含新增的操作 ID 和本地 frame IPC 测试；恶意 frame 桌面桥接回归也已在本机通过。详见 0.6.1 验收摘要。

精确发布提交 f9407191f9a8493a8b767370183811c460aa743b 已通过 Windows 与 Ubuntu DPA 检查，以及 CodeQL 的 Actions、JavaScript/TypeScript 分析。GitHub 当前开放 CodeQL 告警为 0；0.6.0 首次检出的两项问题均已由本提交自动标记为已修复。

请只从 Releases 下载版本匹配的 0.6.1 安装版/便携版，并核对 SHA256SUMS.txt。DPA 不内置 DSH，仍需按 Windows 安装指南另行准备已配置的运行时。

DeepSeek-PA is an independent community project, not an official DeepSeek product. DSH and third-party components retain their respective licenses.

DeepSeek-PA v0.6.0 — Paginated discovery, reliable project startup and a refreshed workspace

Superseded / 已被取代： v0.6.0 is retained as an immutable historical release. Please use v0.6.1, which includes all 0.6.0 features and fixes the two CodeQL findings discovered after publication. / v0.6.0 作为不可变历史版本保留；请改用包含全部 0.6.0 功能并修复发布后两项 CodeQL 问题的 v0.6.1。

---

DeepSeek-PA v0.6.0 — Paginated discovery, reliable project startup and a refreshed workspace

English | 简体中文

English

DPA is an unofficial modular Windows desktop workspace built around DeepSeek Harness (DSH). Version 0.6.0 remains a developer preview, tested with DSH 0.1.5-rc.2.

Changes

• Discovery: GitHub repository search now preserves the visible query and supports sorting, previous/next pages, page jumps, and 30 / 60 / 100 items per page. The curated list is a separate source; result totals and the equivalent GitHub search are accessible.
• Project startup: updated credential-file and ACP-launch compatibility, startup checks, persistent errors, retry and duplicate-click protection. Failures and cancellation clear stale running state and empty streams.
• Runtime resilience: bounded model waiting, cancellation handling, safer child-process failure handling, parallel-worker cleanup and more explicit permission handling.
• Workspace design: clearer navigation, employee cards, project lists, discussion typography, task panels and keyboard focus. Approval details scroll within a bounded panel; small windows keep task details below the conversation.
• Startup stability: webview work waits for readiness before page operations, preventing an initialization-time unhandled error.

Installation and compatibility

Download the versioned setup .exe or portable .zip from Releases, and verify SHA256SUMS.txt. Follow the Windows installation guide.

DSH, its package-manager/runtime requirements and model credentials must be configured separately; DSH is not bundled. Windows x64 only; binaries are not commercially code-signed. Assets absent from the Release have not been published.

Validation and limits

Local validation included 98 regression tests, packaged UI interactions with six themes, real GitHub pagination and a minimal real ACP request. See the validation summary for the evidence and its limits.

• GitHub Search API exposes at most the first 1,000 results per query. DPA displays this limit; refine the query to explore other results. Visible repositories are not necessarily installable extensions.
• Themes cover DPA's own shell, Cluster and Extension Center. Newer upstream Agent pages are not fully color-adapted; remote Chat retains its website appearance.
• Employee development changes profiles and prompts, not model weights. Fine-tuning/distillation is not implemented. Public discussion excludes hidden model reasoning.
• Synthetic screenshot fixtures demonstrate UI behavior; the 75 discovery results are simulated. No claim is made that synthetic UI checks prove full real-project delivery or multi-day stability.

简体中文

DPA 是基于 DeepSeek Harness（DSH）构建的非官方模块化 Windows 桌面工作台。0.6.0 仍为开发者预览版，已测试 DSH 0.1.5-rc.2。

更新内容

• 扩展发现： 保留界面可见的 GitHub 查询，支持排序、上一页/下一页、跳页和每页 30 / 60 / 100 项。DPA 推荐独立为一个来源，可查看总数并打开同条件 GitHub 搜索。
• 项目启动： 适配新版凭据和 ACP 入口，补齐启动前检查、持续错误提示、重试及重复点击保护；失败和取消后清理旧运行状态及空流式消息。
• 运行稳定性： 补齐模型等待上限、取消响应、子进程异常处理、并行员工清理和权限判断。
• 桌面界面： 改善导航、员工卡片、项目列表、聊天字体、任务面板与键盘焦点；审批内容独立滚动，小窗口下任务面板移到讨论区下方。
• 启动安全： WebView 就绪后再进行页面操作，避免初始化时的未处理异常。

安装与边界

从 Releases 下载版本匹配的安装版或便携版，并检查 SHA256SUMS.txt，详见安装指南。本版没有内置 DSH，需另外准备 DSH、其依赖工具及模型凭据。仅提供 Windows x64 预览版，尚无商业代码签名；Release 未列出的附件表示尚未发布。

本地已完成 98 项回归测试、六种主题的打包交互、真实 GitHub 分页和最小真实 ACP 请求，证据与限制见验收摘要。

• GitHub Search API 每个查询最多翻阅前 1,000 项，DPA 会展示该边界；可细化关键词继续检索。检索结果不等于兼容扩展。
• DPA 原生模块共享主题；新版上游 Agent 仍有配色未覆盖处，远程 Chat 保持网站原样。
• 员工培养属于配置与提示词调整，未实现微调或蒸馏；公开讨论不展示隐藏思维。
• 所有展示截图均为合成数据，发现页 75 项是模拟仓库。UI 模拟验收不能替代真实项目交付或多日压力测试。

DeepSeek-PA is an independent community project, not an official DeepSeek product. DSH and third-party components retain their respective licenses.

DeepSeek-PA v0.5.1 — First Public Developer Preview（dsh-desktop）

DeepSeek-PA v0.5.1 — First Public Developer Preview

English | 简体中文

English

DeepSeek-PA (DPA) is an unofficial modular Windows desktop workspace built on DeepSeek Harness (DSH). This is the first public developer-preview release.

Highlights

• Separate Agent and Chat workspaces
• Modular extension center for plugins, Skills, themes and future capabilities
• Application-wide themes, typography, zoom and independent image backgrounds
• Persistent employee-agent profiles with roles, models, Skills, development history and versions
• Multi-agent Cluster projects with hierarchical, collaborative and autonomous governance policies
• Public project discussion separated from tasks, tool traces, computer actions, diagnostics and telemetry
• Human approval gates for plans and deliverables
• Request approval, risk-managed automatic execution and project-scoped full-access modes
• Local-first project records, atomic snapshots, bounded event buffers and crash diagnostics

Important requirements

This release does not bundle the DeepSeek Harness runtime. Before launching DPA, install and prepare a compatible local DSH checkout, Node.js 22+ and pnpm, then set DSH_DESKTOP_HARNESS_DIR to the DSH root directory. See INSTALL-WINDOWS.md below the release assets for details.

Downloads

• Setup: DeepSeek-PA-Setup-0.5.1-win-x64.exe
• Portable: DeepSeek-PA-0.5.1-win-x64-portable.zip
• Integrity: SHA256SUMS.txt

Known limitations

• Windows x64 only
• Developer preview; compatibility may change with DSH release candidates
• DSH runtime and model credentials must be configured separately
• No commercial code-signing certificate; Windows may show an unknown-publisher warning

All screenshots and release validation use synthetic demo data. No personal project, account, local path or credential data is included in the package.

简体中文

DeepSeek-PA（DPA）是基于 DeepSeek Harness（DSH）构建的非官方模块化 Windows 桌面工作台，这是第一个公开开发者预览版。

主要功能

• 将工具型 Agent 工作区与普通 Chat 对话分开
• 统一管理插件、Skill、主题以及未来 DPA 模块的扩展中心
• 作用于整个程序的主题、字体、缩放和独立图片背景
• 可长期维护的员工智能体，包含角色、模型、Skill、培养记录和版本
• 支持分级负责、协作共创、授权自治三种治理策略的集群项目
• 将项目公开讨论与任务、工具轨迹、电脑操作、诊断和遥测分开
• 项目计划与最终交付均设置用户审批门禁
• 支持逐项请求批准、风险托管自动执行、项目工作区内完全访问三种权限
• 本地优先的项目记录、原子快照、有限事件缓存和崩溃诊断

重要依赖

本版本没有内置 DeepSeek Harness 运行时。运行 DPA 前，需要准备兼容的本地 DSH 源码、Node.js 22+ 与 pnpm，并把环境变量 DSH_DESKTOP_HARNESS_DIR 指向 DSH 根目录。详细步骤见 Release 文件旁的 INSTALL-WINDOWS.md。

下载选择

• 安装版： DeepSeek-PA-Setup-0.5.1-win-x64.exe
• 便携版： DeepSeek-PA-0.5.1-win-x64-portable.zip
• 完整性校验： SHA256SUMS.txt

已知限制

• 当前仅支持 Windows x64
• 仍处于开发者预览阶段，DSH 候选版本更新可能带来兼容变化
• DSH 运行时和模型凭据需要单独配置
• 尚未购买商业代码签名证书，Windows 可能提示“未知发布者”

截图和发行验证全部使用虚构演示数据，安装包不包含个人项目、账号、本机路径或凭据。

---

DeepSeek-PA is an independent community project and is not an official DeepSeek product.